Refining Beale Cipher B1’s cipher table…

by ⋅ 18 Comments

By now, everyone and his/her crypto-dog must surely know that the second Beale Cipher (“B2”) was enciphered using a lookup table created from the first letters of the words of the Declaration of Independence: that is, a number N in the B2 ciphertext corresponds to the first letter of the Nth word in the DoI.

Even working out that this was the case was far from trivial, because the version of the DoI used was non-standard, and there were also annoying numerical shifts (which strongly suggest that the encipherer’s word numbering messed up along the way). There were also a few places where the numbers in the B2 ciphertext appear to have been miscopied or misprinted.

Yet I don’t share the view put forward by some researchers that this would have made it nigh-on-impossible for anyone to figure out that the DoI had been used, simply because most of the number instances are low numbers, i.e. they are concentrated near the front end of the DoI where there are fewer differences with normal DoI’s, and before the numbering slips started to creep in. This means that even if you used nearly the right DoI, a very large part of the ciphertext would become readable: and from there a persistent investigator should be able to reconstruct what happened with the (not-so-straightforward) high-numbered indices to eventually fill in the rest of the gaps. Which is basically where Beale research had reached by the time Ward’s pamphlet was printed.

So far, so “National Treasure”. But this isn’t quite the whole story, because…

B1 Used The Same Table!

Even if we have so far failed to work out precisely how B1 was enciphered, we do also know something rather surprising, courtesy of Carl Hammer and Jim Gillogly: that the process used to construct B1 used almost exactly the same DoI used to encipher B2. Jim Gillogly, in his famous article “The Beale Cipher: A Dissenting Opinion” [April 1980, Cryptologia, Volume 4, Number 2, pp.116-119, a copy of which can be found in the Wayback Machine here] concluded that the ‘plaintext’ patterns that emerged from this were artificial nonsense, and so B1 (and by implication B3) were empty hoax texts, i.e. designed to infuriate rather than to communicate.

From the same evidence, Carl Hammer concluded (quite differently) that B1 and B2 were encrypted in the same way using the same tables, though he didn’t have a good explanation for the mysterious patterns. For what it’s worth, my own conclusion is that B1 and B2 were encrypted slightly differently but using the same tables, which is kind of a halfway house between Gillogly’s coglie and Hammer’s clamour. 😉

All three agree on this: that if you plug the DoI’s first letters into the B1 ciphertext, mysterious patterns do appear (more on those shortly). But for many years, my view has been that Gillogly’s end conclusion, though clear-headed and sincere, was both premature (because I don’t believe he had eliminated all possible explanations) and unhelpful (because it had the possibly unintentional effect of stifling nearly all subsequent cryptological research into the Beale ciphers).

Regardless, it seems highly likely that almost exactly the same DoI was used to construct B1 as was used to encipher B2. This is because the statistically improbable mysterious patterns only emerge in the B1 plaintext if you use the DoI.

Furthermore, what I think is quite striking is, as I pointed out some years ago, that if you use the corrected cipher table (i.e. the cipher table generated from the same DoI and using the same numerical mistakes as were used in the cipher table used to construct the B2 cipher text), the mysterious patterns not only remain, but become even more statistically improbable than before.

What this implies, I believe, is that not only was the same non-standard DoI used in both, but also the same enciphering tables derived from it, numerical errors and all.

Here’s what B1 looks like when combined with the raw DoI (numbers above 1000 map to ‘?’)

s c s ? e t f a ? g c d o t t u c w o t w t a a i w d b i i d t t ? w t t a a b b p l a a a b w c t
l t f i f l k i l p e a a b p w c h o t o a p p p m o r a l a n h a a b b c c a c d d e a o s d s f
h n t f t a t p o c a c b c d d l b e r i f e b t h i f o e h u u b t t t t t i h p a o a a s a t a
a t t o m t a p o a a a r o m p j d r a ? ? t s b c o b d a a a c p n r b a b f d e f g h i i j k l
m m n o h p p a w t a c m o b l s o e s s o a v i s p f t a o t b t f t h f o a o g h w t e n a l c
a a s a a t t a r d s l t a w g f e s a u w a o l t t a h h t t a s o t t e a f a a s c s t a i f r
c a b t o t l h h d t n h w t s t e a i e o a a s t w t t s o i t s s t a a o p i w c p c w s o t t
i o i e s i t t d a t t p i u f s f r f a b p t c c o a i t n a t t o s t s t f ? ? a t d a t w t a
t t o c w t o m p a t s o t e c a t t o t b s o g c w c d r o l i t i b h p w a a e ? b t s t a f a
e w c a ? c b o w l t p o a c t e w t a f o a i t h t t t t o s h r i s t e o o e c u s c ? r a i h
r l w s t r a s n i t p c b f a e f t t

Of the many artificial-looking sequences here, the one that caught Hammer’s and Gillogly’s eyes was:

a b f d e f g h i i j k l m m n o h p p

If we instead plug the same set of B1 numbers into the corrected DoI cipher table, this is what you get:

s b s ? e t f a ? g c d o t t u c w o t w t a a i s d b t i d t t ? w t f b a a b a d a a a b b c d
e f f i f l k i g p e a m n p w c h o c o a l l p m o t a m a n h a b b b c c c c d d e a o s d s t
b n t f t a t p o c a c b c d d e p e t p f a b t h i f f e h u u b t j t t t i h p a o a o s a t a
b t t ? m n m p a a a a r b o p j d t f ? ? t s b c o h d a f a c p n r b a b c d e f g h i i j k l
m m n o h p p a w t a o m b b l s o e s a t o f i s p c t a o l b t f l h d o a h g b w t e n c l c
a s s a a s t a t d t g t a w g f e a a o c a a a t t w h t t t a a o e t s a f a a s b s t c i h r
c a b t o t s c t d c n h w t s t e h i o o a t s t w t t s o f a a s t a a m s i w c p c w s o t l
i n i e e i t t d a t t p i u f a e r f a b p t c t a o i d n a t t o a t s t a ? ? a t m a t w n w
t t o c w t o t p a t s o t e b a t r c h b t o g a w c d r o l i t i a h l w a a s ? b c s t a f a
e w c m ? f t o w l t s o c c t e w t a f o a o w t t t t t o t h r i s u e o h a c u a f ? p o i h
r m s s t r a s n i t p c t u o w f t t

This yields even more mysteriously ordered patterns than before:
* a a b a d a a a b b c d e f f i f
* a b b b c c c c d d e
* a b c d e f g h i i j k l m m n o h p p

Sorry, Jim, but something is going on there to cause feeding B1’s numbers into the refined DoI to produce these patterns: and even if I agree that the rest of the Beale pamphlet is a steaming heap of make-believe Boy’s Own backfill, I still don’t think the B1 ciphertext is a hoax. There’s just too much order.

Filling In The Gaps

Now, if it is true that exactly the same cipher table was used to construct both B1 and B2 (and though I believe this is highly likely, I have to point out that this remains speculative), these mysterious patterns may offer us the ability to advance our understanding of the cipher table yet further. This is because we can look at those places where the mysterious patterns break down in mid-sequence, and use those places to suggest corrections either to the table or to the B1 ciphertext itself. That is, even if we can neither decrypt nor understand B1, we can still use its mysterious plaintext patterns to refine our reconstruction of the enciphering table used to construct it and/or our understanding of the B1 ciphertext itself.

150=a 251=a 284=a 308=b 231=b 124=c 211=d 486=e 225=f 401=f 370=i 11=f

370=importance BUT 360=forbidden, so I suspect that 370 may have been a copying slip for 360.

24=a 283=c 134=b 92=c 63=d 246=d 486=e

283=colonies BUT 284=and, so I suspect that 283 may have been a copying slip for 284.

890=a 346=a 36=a 150=a 59=r 568=b

59=requires, but I’m not sure what happened here.

147=a 436=b 195=c 320=d 37=e 122=f 113=g 6=h 140=i 8=i 120=j 305=k 42=l 58=m 461=m 44=n 106=o 301=h 13=p 408=p

301=history BUT 302=of, so I suspect that 301 may have been a copying slip for 302.

OK, I’d agree this isn’t a huge step forward: but given that the printed version of (the solved!) B2 has seven similar copying slips…

* B2 index #223 is ’84’, but should be ’85’
* B2 index #531 is ’53’, but should be ’54’
* B2 index #571 is ‘108’, but should be ‘10,8’
* B2 index #590 [#591] is ‘188’, but should be ‘138’
* B2 index #666 [#667] is ‘440’, but should be ’40’
* B2 index #701 [#702] is ’84’, but should be ’85’
* B2 index #722 [#723] is ’96’, but should be ’95’

…I’d expect that we’re likely to have between 10 and 20 copying slips in B1’s series of numbers. That, combined with the larger ratio of homophones (i.e. as compared with the size of the ciphertext), keeps pushing B1 out of the range of automated homophonic ciphertext solvers. So all we can do to try to correct for those may well be a help!

“Folklore: Prince Edward Island” by Sterling Ramsay…

by ⋅ 1 Comment

My bibliographic search for more information about the Hollow River Cipher led to Sterling Ramsay’s (1973) “Folklore: Prince Edward Island”.

It’s a nice little book, that tries to enjoy local folkloric tales of ghosts, spirits and buried treasure from Prince Edward Island without the intrusion of too much critical thinking, a tradition that has (apparently) continued to the present day with the PEI Ghosthunter’s Society.

As to the author, there’s a picture (presumably) of Sterling Ramsay circa 1973 on the back cover, though inverted and coloured orange. A few minutes with GIMP produced the following reconstruction:

Does Ramsay have anything more to say about the Hollow River story that the Prince Edward Island Magazine didn’t back in 1900?

The answer is… not a lot, but that’s perhaps to be expected. What we do learn is that (p.61):

Many years went by until the original parchment note fell into the hands of a Mr. Donald MacDougall who came originally from the Brackley area of the island. To say that he became intrigued with the note would be quite an understatement, for, according to various accounts, he became almost obsessed with the desire to decipher the note’s hidden message. He spent every free moment arranging in various forms the jumbled letters with the hope of finding some clue to their meaning, but all in vain. This in itself was not enough to discourage him however. He showed it to every person whom he considered as likely of obtaining an idea of its contents. But all without success, none could understand any part of it but that which he could plainly see for himself, that is, what appeared to be a date, the 10th day of a month, A.D., 1738. At length he began to suspect that he was merely being made the butt of some seaman’s cruel joke, so his interest soon waned and for the moment, at least, all thoughts of the mysterious message fled from his mind. This was not to be very long lived, however, as he was soon to discover.

Who Was Donald MacDougall?

A quick Internet search revealed several mid-19th century Donald MacDougalls on Prince Edward Island, all descendants of a (presumably too early?) Donald MacDougall:

1. born on 24th December 1847 in Grand River, Prince, Prince Edward Island, son of James MacDougall (b. 1789) and Margaret Plaisted. Donald MacDougall married a Mary Gillis on 27 Nov 1866.
2. born on 24th January 1842 to Roderick MacDougall (b. 1812) and Mary MacKinnon.
3. born on 5th November 1844 to Jonathan MacDougall (b. 1813) and Anne MacNeil.
4. born on 20th August 1850 in Grand River, Prince, Prince Edward Island to Michael MacDougall (b. 1818 in Grand River, Prince, Prince Edward Island) and Anne Gillis (died 22nd May 1902). He died on 4th May 1929 in Grand River, Prince, Prince Edward Island.

The “various accounts” mentioned by Sterling Ramsay are probably different family retellings of the same basic story, handed down a couple of generations. (There’s nothing like a bit of elusive pirate treasure talk around a family hearth, right?)

Sterling Ramsay

Is Sterling Ramsay still alive? There’s a picture of a Sterling Ramsay of Charlottetown shovelling snow in 2015 in a local PEI newspaper:

And, in a timely coincidence, it seems likely to me that this is probably the same Sterling Ramsay who elaborately decorates his house on Euston Street every Halloween to scare local children: though sadly the local Guardian’s online archive seems to have lost the pictures of him with the Grim Reaper and shaking hands with the Devil. But I’m sure you get the basic idea. 🙂

From collecting folkloric ghost stories to improvised Halloween house-theatre, it seems like there could easily be a consistent thread of interest weaving through his life, wouldn’t you say, hmmm? 😉

Gustina Scaglia, the Machine Complex Authors, and weak vs strong research questions…

by ⋅ 7 Comments

For more than forty years, the late historian Gustina Scaglia researched 15th and 16th manuscripts containing drawings of machines. This led to her writing (some with Frank D. Prager) a number of highly regarded books, a good number of which I can afford (and have copies of) and a fair few my budget cannot easily stretch to. :-/ The list of her machine-related papers stretches back at least to her 1960 NYU thesis Studies in the “Zibaldone” of Buonaccorso Ghiberti (Advisor: Richard Krautheimer).

Overall, I think what emerged can be fairly described as a decades-long research programme to work out how these technical books and drawings fitted together into an larger inventive tradition – i.e. to determine where machine ideas really came from, and how they flowed from manuscript to manuscript, being adapted and adjusted as they went.

In many ways, Scaglia achieved just about everything she aimed to do: her accounts of Brunelleschi, Mariano Taccola, and Francesco di Giorgio’s books (and all their copybooks and derivative works, sprawling through the 16th century and beyond) in many ways exemplify the best of historical scholarship – despite covering such a large area, they are well researched, well thought through, and lucidly presented. And yet…

The Hole At The Centre: The Machine Complex Authors

It’s hard not to notice that there is a hole at the centre of Scaglia’s account, one which never seems to have been resolved (at least, not in those papers and books of hers that I’ve read). Although a very large number of machine drawings in Francesco di Giorgio’s books were derived directly from Mariano Taccola, Francesco di Giorgio also had a second major source for his machine drawings, a source which Scaglia was able to track only indirectly: she called these sources “the Machine Complex Authors“.

(Note that her 15th century Machine Complex Author(s) are different from the quite separate 16th century person she calls The “Machine Complex Artist”, who she concludes was active in Siena, and whose works Oreste Vannucci Biringucci copied into his books of drawings. I thought I’d mention this as it’s easy to get confused by these two similar names.)

Scaglia talks a little about the Machine Complex authors in her “Francesco di Giorgio: Checklist and History of Manuscripts and Drawings in Autographs and Copies from ca. 1470 to 1687 and Renewed Copies (1764-1839)”, in an early section devoted to Francesco di Giorgio’s Opusculum de Architectura (British Museum 197.b.21, formerly MS Harley 3281):

Francesco’s other engine designs in the Opusculum, which may be briefly designated as the Machine Complexes, and fort plans had all been composed by anonymous artisans in 1450-1470 or earlier, none of which appear in Taccola’s sets […] These Machine Complex designs, largely formed in the artisans’ imaginations, are often inoperable, greatly constricted by the box frame in which the components are fitted […] [p.43]

Essentially, by the time sixteenth century engineers began to look with a more experienced eye at these 15th century drawings, it was clear that they were almost all impractical (and indeed occasionally fantastical): that if they were to be built, they would inevitably “move slowly”, as the architect Antonio da Sangallo il Giovane put it.

To the best of my knowledge, if Scaglia ever had an inkling of who might have been the “anonymous artisans” who conjured up those additional Machine Complex drawings that Francesco di Giorgio used, she never wrote it down. This was the hole in her history she never managed to fill: Scaglia’s unfinished business, as it were.

Was Filarete a Machine Complex Author?

In “The Curse of the Voynich” (2006), I explored the idea that the Voynich Manuscript might have been (in some way) a version of the little books of secrets mentioned many times by architect Antonio Averlino, scattered through his libro architettonico. According to Averlino, they contained secrets related to agriculture, water, machines, bees and so forth (though he never actually included a formal list).

Opinions are sharply divided about these little books, allegedly composed during Averlino’s time as ducal architect in Milan (1450-1465): some historians think they never existed at all (i.e. that they were just a literary conceit in Averlino’s part-factual / part-fictional libro architettonico), while others think that they did exist and that trying to make money out of them was one of the reasons Averlino wrote his libro at all. Either way, there is currently no known evidence outside the four walls of the libro architettonico that supports or refutes either account: so all we really have to go on is what Averlino tells us.

However, since 2006, I have further speculated that Averlino might have been the author of some of the Machine Complex drawings. This is historically compatible based on what we know of both: the period when Averlino claimed to have written / invented / compiled his book of machine secrets was within exactly the same period Scaglia concluded the Machine Complex Authors were active in Italy, after Taccola’s works (-1449) and before Francesco di Giorgio’s early works (1470-1475). And Averlino’s death (probably in Rome sometime between 1465 and 1469) would be about the right time for some or all of his books of secrets to make their way out into the world.

Did Scaglia consider the possibility that Averlino may have been one of the mid-Quattrocento Machine Complex Authors? Scaglia did, in 1974, write a glowing review in Isis of Finoli and Grassi’s scholarly edition of Antonio Averlino’s libro architettonico (a review I’ve only read the first page of, sadly), so would have been well aware that Filarete had claimed authorshop of a book of machines, something that fell squarely within her long-term research programme. But perhaps the lack of corroborating external evidence for this meant that positing a link to the Machine Complex Authors would perhaps have been more openly speculative than she was comfortable with: perhaps someone more familiar with her work than me will be able to say.

Machines Hidden In Plain Sight?

If, for the sake of argument, we temporarily accept the premise that Averlino’s book of machine secrets did end up concealed in the Voynich Manuscript, the obvious question is: where are they? When I was researching Curse, it was very easy to see how a book on “agriculture” could be behind the Voynich Manuscript’s herbal pages, and also to see how a book on “water” could be behind the Voynich Manuscript’s ‘balneological’ quire (with its drawings of baths, and even possibly a rainbow at the end): so the absence of machine drawings was an issue that vexed me a great deal.

Though still just as hypothetical as it was more than a decade ago, the prediction this led me to remains controversial, simply because it is both simple and outrageous: that if Averlino’s book on machines (and it would inevitably be, like Taccola’s drawings that went before it, very visually oriented) is somehow hidden in the Voynich Manuscript’s pages, I concluded that the only place it could be hidden in plain sight was in the Voynich Manuscript’s “Herbal B” pages.

The text on (what Prescott Currier famously called) Herbal A pages was written by a larger, more open hand than the scratchy, smaller hand that wrote Herbal B pages: and despite superficial similarities, the two sets of pages have significantly different statistical profiles. Even though Herbal A bifolios have ended up (partially) mixed in with Herbal B bifolios, there seems little doubt that the two were originally composed in separate writing phases, and perhaps even written by different scribes.

Hence: even though both groups of pages are made up of plant drawings (normally one per page) accompanied by blocks of text (sometimes interleaved through the drawings), there seems very strong grounds for concluding that the two groups could well be quite different at heart. One of the things that distinguished Curse was that it proposed that these two groups of pages might well contain two different books – a book on agriculture, and a book of machines.

“Sunflowers” or Gears?

Since writing Curse, I’ve read a lot more of the 15th century machine drawing literature than I was able to before. And even now (in 2018), the systematic set of visual parallels I draw in 2006 seem no less strong: I still don’t see Brumbaugh’s supposed “sunflowers”, but wind-powered mills (and even wind-powered cars, something that had already been invented – though not built – by the early 15th century)

I also don’t see implausible plants, but rather obfuscated details that I suspect represent the racks and pinions that appear in 15th century machine drawings:

Additionally, I see what appear to be concealed versions of the horse-powered (or ox-powered) hoists that were such a mainstay of the 15th century machine drawing tradition (i.e. in Buonaccorso Ghiberti, Taccola, and elsewhere):

Finally: given Filarete’s love of fountains, it’s also easy (once you get to this point in the whole train of thought) to wonder whether some Herbal B Pages depict fountains:

As always, your mileage may vary: make of it all what you will.

Weak vs Strong Research Questions

The research brick wall I ran into with Curse was that Averlino’s books of secrets are – as far as anyone can say – entirely internal to his libro architettonico, making them virtual, unproven, implicit, or even absent: no-one can tell. And as for whether Gustina Scaglia ever considered (or even pursued) the idea of Averlino as a possible Machine Complex Author, she passed away 15 years ago, so that’s not really an avenue that can be followed.

However: what struck me in the last few days is that even though individually both are weak (i.e. untestable) research questions, if you put the two together you get a strong research question – by which I mean a question that can be tested against actual evidence, and perhaps falsified or proved. The point is that whatever trying to answer the question reveals, it should be possible to use the result to learn something new.

That is, even though the following claims have proven almost impossible to individually test (i.e. they are weak research questions)…

* that Averlino wrote the Voynich Manuscript
* that Averlino wrote books of secrets including a book of machines
* that the Voynich Manuscript’s Herbal B pages contain encrypted or obfuscated versions of his machine drawings
* that Averlino was one of Scaglia’s Machine Complex Authors whose drawings were copied by Francesco di Giorgio in 1470-1475

…if you put all of them together into a single composite claim…

* that Averlino’s drawings appear both in the Voynich Manuscript’s Herbal B pages and in Francesco di Giorgio’s machine drawings

…you get a strong research question, i.e. something that can actually be tested. So my next step is obviously going to be working out precisely which of Francesco di Giorgio’s drawings came not from Mariano Taccola but from the Machine Complex authors, and then comparing those with the Voynich’s Herbal B page drawings to see if anything connects the two.

However, apart from some references by the British Museum’s curators to figures in an unnamed book by someone called “Mancini” (presumably Girolamo Mancini?), I don’t know if there is a facsimile reproduction of the Opusculum de Architectura – if anyone happens to know a facsimile of the Opusculum or what the name of Mancini’s book is, please let me know, thanks!

More generally, what I find interesting here is that for many years I have spent a lot of time trying to break down big research questions into smaller questions that can be researched and tested atomically. Yet here I’m having to work in quite the opposite direction, simply because the individual smaller research questions are each too weak to be answered. And that makes me wonder whether we as historical researchers are sometimes hamstrung for lack of larger vision: that we can spend too much time on tiny questions that we can only partially answer, when we should (at least some of the time) also try to construct larger, more daring problematiques (as the Annales historians liked to put it), which would be testable in quite different (and perhaps far more revealing) ways. Just something to think about, anyway.

Scorpion S1, a different view…

by ⋅ 10 Comments

The story of the ‘Scorpion’ letters to John Walsh, host of “America’s Most Wanted” and (more recently) “The Hunt with John Walsh”, is now reasonably well known. From 1991, Walsh received a string of threatening letters from someone signing themselves “SCORPION”, and also containing cryptograms. Since 2007, two of these cryptograms (“S1” and “S5”) have been released by the FBI: however, none has yet been solved.

The Scorpion also wrote:

I now realize with many hundreds of hours of mindracking experimentation with my complex ciphers that my first one that I sent you was comparatively simple to my second, third, fourth, and now temporarily final cryptograph system. I have been encoding useful information for your use and have done it fairly, since all of my ciphers can be decoded simply, once the limited patterns and systems are discovered.

I’ve blogged before about how the S5 cryptogram (arranged as 15 rows of 12 symbols each) only ever has repeats where the distances between symbols is a multiple of 16, suggesting that it may well be composed of 16 strictly cycling cipher alphabets. I similarly suggested that S1 appeared to have repeats largely centred around multiples of 5, though this distance was far less solid.

Here’s what S1 (the first Scorpion cryptogram) looks like:

To make some kind of organizational sense of this, I tried to follow the basic pattern laid down by the S5 ciphertext, by:
* assigning symbols to five cycling columns
* mostly resetting these at the leftmost column of ten
* assuming that the encipherer’s first cipher system usage wasn’t as disciplined as his later (far more complex) efforts.

Here, you should be able to see all the same symbols as S1 (and in the same order), but assigned to five columns, where the shapes in each column are (mostly) thematically grouped. The only exception to this rule is the mirrored ‘L’ shape, which appears both in column #2 and in column #4. My strong suspicion is that this was an enciphering slip, where a simple geometric shape appeared in two different columns’ cipher alphabets by mistake.

Is this solveable? If I’m even roughly correct about the grouping, then S1 was, like S5, almost exactly the same category of cipher for which I put forward a sequence of challenge ciphers in 2017 (and all of which remain uncracked). There, the first challenge cipher was 153 symbols long, laid out in five perfectly cycling groups. This was more than twice as long as S1, and with the added benefit that I even told you exactly what kind of cipher it is. The second challenge ciphertext was slightly shorter (118 symbols): and so forth.

Can We Crack S1?

On the one hand, the multiplicity of the Scorpion ciphertexts is very high, meaning that pure homophone solvers stand almost no chance.

On the other hand, I’m pretty sure that these aren’t pure homophonic ciphers, insofar as each group of symbols almost certainly will have at most one A shape, at most one B shape etc. We might also try searching ‘down’ from setups that assume that repeated symbols in each group are not randomly chosen, but are most likely frequently used letters, e.g. ETAOINSH. With a long enough ciphertext to work with, this would be the preferred ‘classical’ way to attack the cipher: but, alas, we only have short ciphertexts to work with here. 🙁

However, my understanding is that there has been a handful of historical examples where particular ciphertexts of this general type (i.e. based around a cycle of interleaved cipher alphabets) have been cracked by determined cryptanalysts. So I’m not yet convinced it’s impossible.

All the same, has a specifically optimized machine algorithm for cracking these ever been put forward?

At last (Take #2): “Ronald Francis” was chemist John Freeman of 24A Jetty Road, Glenelg…

by ⋅ 141 Comments

Apologies again for previously repeating the incorrect identification of “Ronald Francis” as Dr Douglas Buxton Hendrickson. However I can fully rectify that in the best way possible, by passing on today’s announcement courtesy of Gerry Feltus: from which we can say (hopefully definitively) that “Ronald Francis” – in whose car the Rubaiyat was found – was in fact chemist John Freeman of 24A Jetty Road, Glenelg.

I have established that the person who owned the car in which the relevant copy of the Rubaiyat was located and his wife are both deceased. Their next of kin have recently given me permission to release identities and details relevant to the ‘Unknown Man’ investigation. John Freeman, in December, 1948, was a Chemist, and resided with his wife in premises attached to their Chemist shop, at 24A Jetty Road, Glenelg. Their family car, a small Hillman Minx was more often than not parked in Jetty Road, outside their shop/residence.

Gerry Feltus goes on to say that he will soon be releasing more details about the interviews he carried out, which I (unsurprisingly) very much look forward to reading.

Trove had no obvious reference to John Freeman: but in January 1945, a Colin Charles Freeman did have a thief in his Jetty Road flat stealing a purse containing four pounds and six shillings. This leads us to an announcement dated 11 Sep 1945:

To whom it may concern. Declaration is hereby made that on August 20, 1945, Colin Charles Freeman and John Christian Freeman, chemists, of Adelaide, disposed of all interest and share in, and connection with, Howard Products. Aust.

With this, plus a little help from a long-running Somerton Man thread on Reddit, we can see that the two Freeman chemists were both cremated in Centennial Park:
* Colin Charles Freeman died on 23 March 1985. (Last abode: Somerton Park)
* John Christian Freeman died on 20 January 2014. (Last abode: Belair)

Both brothers are also listed as associates of the University of Adelaide in the 1955 Calendar (p.140):
* Freeman, Colin Charles…..1944
* Freeman, John Christian….1943

Beyond that, however, there seems to be little in Trove or elsewhere about either of them. Though I suspect this may improve before very long…

John Christian Freeman

According to Rootsweb:

Birth: 10 Jul 1922 in Parkside, Adelaide, South Australia, Australia
Note: Born: John Christian FREEMAN. Father : Charles Herbert FREEMAN. Mother : Doris Sylvia BERNAN.
Source : South Australian Births 1907 – 1928. Book : 98A Page : 358 District : Ade.

Colin Charles Freeman

According to Rootsweb:

Birth: 11 Dec 1920 in Unley, Adelaide, South Australia, Australia
Note: Born: Colin Charles FREEMAN. Father : Charles Herbert FREEMAN. Mother: Doris Sylvia BERNAN.
Source : South Australian Births 1907 – 1928. Book : 67A Page : 109 District : Ade.

According to the MyHeritage site:

Colin Charles Freeman was born in 1922, to Charles Herbert Freeman and Doris Sylvia Freeman [nee Bernau]
Charles was born on May 4 1897, in West Thebarton, South Australia, Australia.
Doris was born on July 18 1898, in Eaglehawk, Victoria, Australia.
Colin had 2 siblings.
Colin married Margaret Cynthia Freeman (born Grasby) on [– –] 1944, at age 22 at [——].
Margaret was born on September 25 1922, in “Xarma” Nursing Home, South Terrace, South Australia, Australia.
They had 2 children.
Colin passed away on [March 23] 1985, at age 63.

While at the University of Adelaide, he passed his Practical Inorganic Chemistry examination in 1940.

Finally: for those interested in car-related stories, Colin Charles Freeman appeared in court in regard to a driving incident in 1941:

At an Inquest yesterday into the death of Elizabeth Matthew Harrod, 71, pensioner of Milner street, Prospect, the Acting city Coroner (Mr. G. Ziesing) found that she died at the Royal Adelaide Hospital on May 24 from multiple injuries received when she was struck by a motor car on the Main North road Enfield, on the same day.
Mr. Ziesing found that the negligence of the driver, Colin Charles Freeman, chemist, of Nottage terrace, Medindle Gardens, was not sufficiently culpable to warrant his taking further action.

Hendrickson REWIIIIIIIIIIIIND….?!?!?

by ⋅ 19 Comments

I’ve just had a nice email from Derek Abbott, who tells me that even though the recent documentary’s producer Wayne Groom was – for a long time – convinced that Ronald Francis was Dr Donald Buxton Hendrickson of 13 Pier-street etc etc, he is now no longer sure. Did someone come forward with a name? I now don’t know. Whatever happened to have been said or claimed at the Glenelg screening of the film, everyone involved now appears to be back-pedalling all the way off the end of Glenelg Pier. Which normally ends badly.

To be precise, the Hendrickson name first came up in 2011 when an online researcher (who had been working his way through a list of nearby doctors) ran it past Derek Abbott. Of course, because Dr Hendrickson died in 1979, Derek dismissed it as being incompatible with Gerry Feltus’s account: but as with all mildly-encrypted historical stories, there’s still plenty of room for substitution and adjustment, so who knows?

So now it looks like we may have had a false alarm here. Not sure. Really don’t know. Just thought I’d let you all know.

Trying to identify the mysterious letter ‘^’ on the top line of Voynich f116v…

by ⋅ 49 Comments

It is both interesting and intriguing that Voynich f116v – the final page of the Voynich Manuscript – contains several lines of as-yet-unaccounted-for text. What is interesting is that these lines are almost entirely unlike the “Voynichese” text that fills the rest of the manuscript, and are written in a recognizably European gothic hand typical of the 14th, 15th and indeed early 16th century. Hence they really ought to be easily readable – but what is intriguing is that this seems not to be the case at all.

As with all cipher mysteries, their unreadability has spawned a myriad of dubious readings, starting in the 1920s with Newbold’s “Michiton oladabas multos te tccr cerc portas” (which he squinterpreted as “Michi dabas multas portas”), through the 1970s with Brumbaugh’s “MICHI CON OLADA BA” (which Brumbaugh thought somehow referred to Roger BACON, *sigh*), and onwards and downwards from there. Even Rene Zandbergen, tongue firmly in cheek, once proposed that because the main f116v text block begins with “mich” and ends with “nich”, it can surely only be a veiled reference to Mich[ael Voy]nich himself. (As if Rich SantaColoma needs any more hoaxoline to hurl on his fire, *sigh*.)

Objectively, though, the text on f116v really ought to be the most obvious ‘way in’ to understanding the Voynich Manuscript’s physical history, simply because there’s no obvious reason why it would be enciphered or encoded: and hence careful codicological examination should normally be sufficient to work out not only what was originally written here, but also – as I carefully described back in 2006 – what emendations later owners made (presumably in the name of ‘preservation’) to leave it in such a parlously unreadable state.

Some multispectral imaging has been carried out at the Beinecke, but (unless you know better) only low-quality images leaked out and no paper was ever written. Here’s what the f116v text looks like at (“MB570AM_027_F”), which – I think – shows that there were at least two codicological layers that need to be separated:

Yet here we are, more than a decade after “The Curse of the Voynich” and not obviously any further forward. 🙁 But perhaps there are ways we can make progress… 🙂

A Closer Look At The Top Line

Rather than getting hung up on the bottom three lines, I’d like to focus purely on the top line.

I’ve previously proposed (in 2009) that the ‘^’ shape at the beginning of two of the words might be an ‘s’ shape, e.g. “simon sint (something)”:

Looking at this line in one of the multispectral scans (“MB625RD_006_F”), we can see that there is also evidence of emendation in the letters, but that the base codicological layer is different to that of the “a+hia + maria” layer (which I suspect was the earliest layer):

I think this provides strong evidence – though far from definitive, of course, because of the low quality of the images – that we are looking at at least three codicological layers of text on this page.

What Is That ^ Shape?

Over the last decade, I’ve looked at loads of palaeography books; I’ve read Derolez’s “The Palaeography of Gothic Manuscript Books”; and I just haven’t founf anything that looks like the ‘^’ shape on this line.

I’m not really comfortable with J.K.Petersen’s 2013 claim that “The first letter might be a ‘u'”. And similarly, though I understand where he’s coming from, David Jackson’s reading of this whole line as “Por seber vm cn autentico afecto” seems a little premature, given the codicological difficulties I think we continue to face with almost every letter.

I happily concede that it is possible (as Anton Alipov suggested in a 2015 comment, and also in a post on his blog) the two ^ shapes are the heads of two ‘p’ shape, where the descenders have disappeared. However, given that there seems to be not a hint of this in the multispectral scans, it is far from my preferred explanation. Johannes Albus’ rendering of this line as “poxleber umen[do] putriter” is an example of a reading that requires the second ^ shape to have been a ‘p’.

The alternative remains that this ^ shape is a rare way of writing a Gothic ‘s’ shape, albeit one I’ve not yet managed to find anywhere. But if someone does, I suspect that it will probably be in a mid-fifteenth century document that was written not too far from Konstanz, just so you know. 😉

Has any Voynich researcher already tried hunting for this particular Gothic letter shape in the archives? If yes, then did you find anything? (I know about CSG 754 that Anton mentioned in the context of its spell blocks.)

At last: “Ronald Francis” was Dr Douglas Buxton Hendrickson of 13 Pier St, Glenelg..

by ⋅ 56 Comments

Thanks to online commenter Clive (who was at a screening of the Somerton Man documentary in Glenelg a short time ago), we now know that “Ronald Francis” (in whose car the Somerton Man’s Rubaiyat was found) was in fact Dr Douglas Buxton Hendrickson of 13 Pier St, Glenelg. The information (announced by Derek Abbott at the showing) appeared online on Gordon Cramer’s blog, where it rapidly accreted additional notes courtesy of Byron Deveson and others.

Here’s a picture of Dr Hendrickson from 1950 (found by Clive in Trove):

We know a little more about his (non-medical) interests from this 1944 article:

DR. D. B. Hendrickson’s election to the Glenelg Council for St. Leonard’s Ward comes at an appropriate time, for it is just 105 years since his great-grandfather, the late Mr. John Lawrence) landed from Holdfast Bay at St. Leonards after a voyage from Fifeshire (Scotland). At 34. Dr. Hendrickson is the youngest member of the council. He is a brother of Lyndall Hendrickson, the violinist. He learned the piano for 18 months, when a boy. but says he then became lazy. There was certainly no sign of laziness about him in the boxing ring. A fine amateur boxer, he not only won his Adelaide University blue for boxing, but also displayed great gameness in the ring.

Other hobbies include debating, horse riding, surfing, fishing, and stamp collecting.

Dr Hendrickson’s Timeline

* 18th February 1911: born in Balaklava, South Australia.
* 15th June 1933: Married Eileen Ivy Schurgott at Claremont, South Australia
* Dec 1941: Divorced
* 25th July 1942: Married Doris Arculas Arculus Davis at Perth, WA
* 23rd September 1979: Died Adelaide

From this, it was immediately clear that Gerry Feltus (who was assigned the Somerton Man cold case after 2000, The Unknown Man pp.11) could not have interviewed Dr Hendrickson (who had died in 1979). So it seems a reasonably safe bet that it was not Hendrickson himself but rather Hendrickson’s brother-in-law with whom Gerry Feltus had talked (The Unknown Man pp.104-105). However, Dr Hendrickson had two younger sisters…

* Cynthia Elizabeth b. Gilbert, SA in 1914. (Died 7th April 2008 at Holly Residential Care, Adelaide.)
* Lyndall Maud b. Gilbert, SA in 1917.

…and hence two brothers-in-law…

* Cynthia married Sgt. John Hurst in March 1945.
* Lyndall married Surgeon-Lieut. Graeme Robson, son of Lieut.-Colonel and Mrs. O. W. E. Robson, of Mosman.

There’s a nice picture of (the very talented violinist) Lyndall Hendrickson from 1942 here:

It was reported before Lyndall’s marriage in 1946 that she planned to move to England to continue her musical career there. So… might she still be alive and living in Penzance in Cornwall (at the tender age of 101)? It’s possible.

Two Hendrickson Car Stories

Here’s the first one from 1946:

Car Licence Suspended For an Hour

One hour’s disqualification from driving his car was imposed by Mr. Coombe, S.M.. in the Adelaide Police Court today on Dr. Douglas Buxton Hendrickson, of Pier street, Glenelg, who pleaded guilty to a charge of having driven his car at Adelaide on November 2 while it was uninsured.
In addition to the disqualification he was fined £5.
For having on the same day driven his motor car while it was unregistered he was fined £1 with 10/ costs.

MINIMUM REDUCED

Mr. Coombe said that he would not have ordered any disqualification in this case had he the power to do so. However, he could reduce the minimum term of three months.
Dr. Hendrickson told the court that owing to the pressure of work during the recent measles epidemic he had overlooked the matter of the renewal of his car’s insurance and registration.
When he was stopped by motor traffic police at 11.45 a.m. on November 2 he was returning from the city, where he had been to collect measles serum.
“If my licence is suspended for any great length of time I will find it difficult to carry on my practice without inconvenience to my patients.” said Dr. Hendrickson.

Mr. Coombe said that there were special reasons why, in this case, he had decided to reduce the minimum fine and term of disqualification.
Mr. J. L. Travers appeared for Dr. Hendrickson.

And (on a lighter note) here’s the second one from 1941:

Girl Charmed A Snake; Can’t Get Rid Of It.

MISS LYNDALL HENDRICKSON, TALENTED YOUNG ADELAIDE VIOLINIST, IS SORRY NOW THAT SHE CHARMED A PYTHON.

It followed her into a car at Whyalla, when, for a bet, she charmed it with her violin music.

She had to return to Port Augusta with the python a 6½ft. pet of a Whyalla storekeeper — behind the back seat.

It was still there the next morning. The owner wants it back alive, so, if Miss Hendrickson can’t charm it out of the car with her violin, part of the car will have to be dismantled.

(Lyndall had another snake-related story reported here.)

Introduction to Beale Cipher B2…

by ⋅ 5 Comments

To decipher the sequence of numbers that make up the second Beale Cipher (‘B2’), you use them to index into the words a slightly-mucked-around version of the Declaration of Independence (A.K.A. a “book cipher” / “dictionary cipher”): the sequence of initial letters this produces yields the decrypted plaintext. Errm… except that this isn’t the whole story: thanks to the Committee of Five’s inexplicable omission of a right to bear xylophones, yoyos, or zebras, the B2 cipher maker also had to improvise a second “rare letter cipher” to encipher rare word-initial letters such as x- and y-. (But that’s a post for another day.)

For book ciphers that literally use dictionaries as their code book, this wouldn’t be a problem (because they necessarily go all the way from aardvarks to zymurgy). Of course, given that the letters of the alphabet appear there in strictly ascending order, using an actual dictionary would probably be a bit dumb. Hence people use book ciphers instead, preferably ones with zebras playing xylophones. 😉

So: strictly speaking, then, Beale Cipher B2 doesn’t employ a pure book cipher, but instead uses a slightly hybridized one, where letters absent from the DoI get enciphered by some (currently) unknown means. So here are some numbers to introduce how the book cipher part of the B2 cipher system works.

B2’s Mapping Statistics

I haven’t seen B2’s letter mapping statistics anywhere on the Internet, so I thought this would be a good place to start (note q and z are not used in B2, so do not appear):

* a [43/15,av=2.9,34.9%]: 24[4] 36[2] 28[5] 147[2] 45[1] 81[4] 98[3] 51[4] 284[1] 150[6] 27[2] 230[4] 83[2] 25[2] 152[1]
* b [11/7,av=1.6,63.6%]: 308[1] 9[1] 77[4] 18[2] 134[1] 485[1] 194[1]
* c [19/7,av=2.7,36.8%]: 84[7] 65[2] 92[2] 4[3] 94[1] 200[2] 21[2]
* d [49/11,av=4.5,22.4%]: 52[10] 15[8] 211[3] 118[4] 63[11] 252[1] 135[2] 246[3] 320[5] 406[1] 582[1]
* e [103/14,av=7.4,13.6%]: 37[13] 49[6] 7[15] 79[4] 85[11] 138[15] 191[7] 620[2] 486[3] 511[6] 548[2] 603[4] 575[2] 33[13]
* f [21/8,av=2.6,38.1%]: 196[4] 160[4] 122[6] 273[1] 131[3] 360[1] 666[1] 11[1]
* g [15/4,av=3.8,26.7%]: 270[3] 48[6] 113[5] 133[1]
* h [37/8,av=4.6,21.6%]: 73[8] 107[5] 394[1] 6[4] 20[9] 301[2] 205[7] 466[1]
* i [55/12,av=4.6,21.8%]: 115[5] 647[1] 140[15] 2[7] 8[12] 154[4] 314[2] 159[1] 67[4] 185[1] 241[2] 370[1]
* j [2/2,av=1.0,100.0%]: 120[1] 581[1]
* k [1/1,av=1.0,100.0%]: 305[1]
* l [32/10,av=3.2,31.3%]: 42[5] 101[6] 102[7] 234[1] 400[4] 158[3] 197[1] 420[3] 177[1] 405[1]
* m [6/4,av=1.5,66.7%]: 58[1] 82[1] 117[2] 208[2]
* n [69/8,av=8.6,11.6%]: 47[13] 10[13] 287[8] 353[8] 607[2] 540[10] 44[13] 557[2]
* o [63/12,av=5.3,19.0%]: 31[7] 56[4] 5[4] 136[3] 46[4] 106[15] 12[6] 43[6] 57[2] 125[9] 143[1] 302[2]
* p [12/4,av=3.0,33.3%]: 17[1] 105[4] 30[5] 121[2]
* r [40/7,av=5.7,17.5%]: 59[5] 53[9] 96[8] 220[8] 248[2] 344[2] 112[6]
* s [48/12,av=4.0,25.0%]: 62[5] 35[6] 71[4] 78[2] 110[11] 38[9] 217[2] 505[3] 600[2] 297[1] 275[2] 285[1]
* t [69/17,av=4.1,24.6%]: 22[4] 29[5] 26[6] 554[1] 3[5] 41[6] 16[9] 34[5] 60[2] 61[3] 14[7] 50[6] 32[4] 64[2] 39[1] 643[2] 288[1]
* u [24/8,av=3.0,33.3%]: 239[3] 316[5] 95[3] 250[6] 371[3] 388[2] 409[1] 440[1]
* v [18/1,av=18.0,5.6%]: 807[18]
* w [13/6,av=2.2,46.2%]: 72[2] 290[1] 19[2] 66[2] 40[5] 1[1]
* x [4/1,av=4.0,25.0%]: 1005[4] (though note that the DOI has no word beginning with x-.)
* y [9/1,av=9.0,11.1%]: 811[9] (though note that #811 = FUNDAMENTALLY, i.e. the DOI has no word beginning with y-.)

That is, ‘a’ appears 43 times in B2 and has 15 homophones, which means that the average number of instances per individual ‘a’ homophone is 2.9, and the proportion of ‘a’ homophones to ‘a’ instances is 34.9%: specifically, index #24 appears 4 times, index 36 appears 2 times, index #28 appears 5 times, and so on.

We can also list these results in order of the well-known ETAOINSHRDLU decreasing frequency mnemonic:
* E [103/14,av=7.4,13.6%]
* T [69/17,av=4.1,24.6%]
* A [43/15,av=2.9,34.9%]
* O [63/12,av=5.3,19.0%]
* I [55/12,av=4.6,21.8%]
* N [69/8,av=8.6,11.6%]
* S [48/12,av=4.0,25.0%]
* H [37/8,av=4.6,21.6%]
* R [40/7,av=5.7,17.5%]
* D [49/11,av=4.5,22.4%]
* L [32/10,av=3.2,31.3%]
* U [24/8,av=3.0,33.3%]

Hence the actual implicit frequency ordering (i.e. in terms of decreasing number of homophones used in B2) was more like:

* 17 T
* 15 A
* 14 E
* 12 O/I/S
* 11 D
* 10 L
* 8 F/H/N/U
etc

DOI letter statistics

We can also look at the letter statistics for the DOI (numbers corrected as per B2), and at how many times each index is used in the B2 ciphertext (i.e. ‘.’ = “index not used”):

* a occurs 166 times: (4)(2)(2)(5)(2)(1)(4)(4)(2).(3)…..(2)(6)(1)………..(4)……(1)………………………………………………………………………………………………………………..
* b occurs 48 times: (1)(2)(4).(1)(1)…(1)…(1)…………………………….
* c occurs 53 times: (3)(2)(2)(5)(2)(1)..(2)……………………………………..
* d occurs 36 times: (8)(10)(11)(4)(2).(3)(3)(1).(5)(1)….(1)……………….
* e occurs 37 times: (15)(13)(13)(6)(4)(13).(15).(7)….(3)..(6).(2)(2)(4)(2)…………..
* f occurs 64 times: (1)(6)(3)(4).(4)..(1)…(1)…………..(1)………………………………
* g occurs 19 times: (6)(5).(1)…(3)………..
* h occurs 78 times: (4)(9)(8)(5).(7).(2)………..(1)……(1)……………………………………………
* i occurs 68 times: (7)(12)(4)(5).(15).(4)(1)..(1)(2)……(2)..(1)………(1)……………………………..
* j occurs 10 times: (1)..(1)……
* k occurs 4 times: (1)…
* l occurs 34 times: (5)(6)(7).(3)(1).(1)(1)…(4)(1)(3)……………….
* m occurs 28 times: (1)(1)(2).(2)…………………..
* n occurs 19 times: (13)(13)(13)…(8).(8).(10)(2)(2)……
* o occurs 144 times: (4)(6)(7)(6)(4)(4)(2)(15)(9).(3)(1)……..(2)……………………………………………………………………………………………………………
* p occurs 60 times: .(1)(5)(4)(2)……………………………………………….
* q occurs 1 times: .
* r occurs 40 times: (8)(5)(7)(6).(8)(2)..(2)…………………………
* s occurs 62 times: (6)(9)(5)(4)(2)(11)……..(2)…(2).(1)(1)…….(3).(2)…………………………
* t occurs 252 times: (5)(7)(9)(4)(6)(5)(4)(5)(1)(6)(6)(1).(2)(3)(2)……………………………………………(1)………………………………………………(1)………..(2)………………………………………………………………………………………………………
* u occurs 28 times: (4)(3)(6)(5)(3)(2)(1).(1)……………….
* v occurs 2 times: (18).
* w occurs 59 times: (1)(2).(5)(2)(2)……(1)……………………………………….

Of course, this clearly confirms the theory that the DOI contains no xylophones, no yoyos, and no zebras. 🙂

As has been pointed out many times, the way that the usage patterns are heavily biased towards low numbers implies that the homophones were mainly taken from the start of the DOI, though with scattered exceptions.

B2’s Homophone Patterns

Because the encipherer used so few of the possible homophones (i.e. because A appears 166 times in the DOI, all 43 instances of A in B2 could have used different symbols, but only 15 homophones for A were used in B2), the ciphertext B2 is solvable as a pure homophone cipher: and in fact some automated homophone solvers can solve Beale B2 unassisted (though not B1 or B3, sadly).

With that in mind, it is also interesting to look at B2’s homophone pattern, to see if this tells us more about how B2 was constructed:

* a homophone sequence: ABCDAEFFCGHHIJKLLMLCFKNLDHOCGBJAMJAGJJJNFCH
* b homophone sequence: ABCCCDCDEFG
* c homophone sequence: ABCCADEFDGABAGFDA
* d homophone sequence: ABACDEAEADECBFEAABGEEBHCIHAIBJIIAIEEKADBABBGDEHEE
* e homophone sequence: ABCDECAFGBEGHGGEACIJAFDJKLCMNEFDBDFCAABFEFNAEABCNGEJCNCILNJKANCNFANCNFEFCCGFEFCANJHFNAEFENACNGJLBCEFIEMLF
* f homophone sequence: ABCCACADCCEAFEGBHBEBC
* g homophone sequence: ABCBCDBCACBCBAB
* h homophone sequence: ABACDEFEBEDAGAGEDEDFBAEBEEGAGGAHBAGEG
* i homophone sequence: ABCDCEFGACDHCEFFEACAAIECDCDEDIECGDCCIDEEJFEKCLCEECIKECC
* j homophone sequence: AB
* k homophone sequence: A
* l homophone sequence: ABCDEFGHBFCCBCFEIACHCEBEHBAAJABC
* m homophone sequence: ABCCDD
* n homophone sequence: ABCDACABDECFGCFAFGDHFEGBBDCAAAGBGDBCGBHAGBFDFAGBGGAFFBBDFGAGBGCCADFBA
* o homophone sequence: ABCDEFABGHIFFHFEFJJCIHGBJKGGAFHFALAFAJHHFEJBJDGFFJFFEAFCJFGCJDL
* p homophone sequence: ABCBDCCDCBCB
* r homophone sequence: ABBCAADCEDFADEBGFDBBDAGCGGDDGCCBCCDBBG
* s homophone sequence: ABCDBEBEAEFGCHBAACIFJFBEFFBGEEFCEAKELFDEHFEFKEHI
* t homophone sequence: ABCDEFGHIECJBKGHFLJKBBEKCHGFMLNOAEJMBLGKACHFLPMCQKILGLHGNAEPFKGGMFKCGR
* u homophone sequence: ABCDBEFFAAEBCDDBDDECGBDCH
* v homophone sequence: AAAAAAAAAAAAAAAAAA
* w homophone sequence: ABCDEFEDCAEEE
* x homophone sequence: AAAA
* y homophone sequence: AAAAAAAAA

My Conclusions

One thing that stands out for me is that only a single homophone for V was used, (a) even though it appeared 18 times in B2, and (b) even though two were available (DOI #818 “VALUABLE” and DOI #1132 “VOICE”). To me, this seems a fairly clear indication that the search for homophones stopped earlier in the DOI. Combine this with the fact that X is #1005, and it seems likely that the highest genuine DOI index would have been (say) 1000: everything after that would be a special secondary code (e.g. for ‘X’).

The Usenet “Markovian Parallax Denigrate” mystery…

by ⋅ 1 Comment

During 5th August 1996, a number of unmoderated Usenet groups were deluged by computer generated spam.

Catherine Hampton, a group administrator for alt.religion.christian.boston-church, wrote:

We have a problem in alt.religion.christian.boston-church — a flood of vertical spam with varying From: lines, posted from different locations, and with no common string to allow us to killfile the slimeball.

The headers appear to be forged, and NNTP posting hosts don’t match Message IDs, which don’t match From: lines. Usually the Path: headers match the Message IDs. The majority of posting hosts/
sites appear to be European, and I recognize one as an open NNTP server used in the past for spamming/net abuse.

Both headers and message text consists of a string of unrelated English words, the majority long and somewhat complex.

Unfortunately, the Path headers have long since been stripped from the archived copies of the messages. However, we can get some idea of what they included from the workarounds Scott Forbes at Lucent suggested as it was all happening:

For YA-Newswatcher, use the following scorefile entries:

Kill where “Path” contains news.wvdp.com
Kill where “Path” contains news.speedline.ca
Kill where “Path” contains news.data.co.za
Kill where “Path” contains CINT_SRV02

For slrn, kill any post containing this header:

Nntp-Posting-Host: bagend.atl.ga.us

For trn 3.6:

/bagend.atl.ga.us/HNntp-Posting-Host:j

Other newsreaders:

If you can do string matching against arbitrary headers, kill any article
with the header “Nntp-Posting-Host: bagend.atl.ga.us”. Note that this is
*not* the same header as “NNTP-Posting-Host” — if your killfile only does
pattern matching against specified “standard” headers, don’t try this.

Which Usenet Groups Were Attacked?

Though there may well have been more, the groups I know to have been attacked were:

* news.admin.net-abuse.misc
* alt.religion.christian
* alt.religion.christian.boston-church
* misc.education.homeschool.christian
* pdaxs.religion.christian
* rec.music.christian
* uk.religion.christian
* alt.fan.jesus-christ

Oddly, some individuals also seem to have been attacked. Catherine Hampton wrote:

I have also been mailbombed by this idiot. I’m not sure how heavily, since after the first couple of messages appeared, I told procmail to send them to /dev/null and informed my ISP about this. I kept copies of the first two mailbomb messages, so if someone needs them to track the idiots down, let me know.

A Typical Message

Because MBOX files are just text files where the headers begin “From ” and there’s a double newline between the message headers and the message body, it’s quite straightforward to have a look at (most of) what was arriving. Here’s an archived message from alt.religion.christian.boston-church (though note that the “X-Deja-AN” line was almost certainly added later by Deja News, and the X-Google lines were added later by Google, who ended up owning the Deja News archives):

From 7995592138590870063
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f788d,1ccdb08619d370e6,start
X-Google-Attributes: gidf788d,public
From: [email protected] (Dick Cerebrate)
Subject: Loft
Date: 1996/08/05
Message-ID: <d1pazxu [email protected]>#1/1
X-Deja-AN: 172316810
organization: Fodder
content-type: text/plain; charset=US-ACSII
mime-version: 1.0
newsgroups: alt.religion.christian.boston-church

treble pharmacology Arnold Sian pinball tsunami matte stockade heater
beauty paraffin keeshond inkling priori Romania proud Alphonse
prim histrionic ensconce meridional foil fob thereafter Thor Ronnie
belligerent Hoyt gerbil Ares boycott surprise Sandusky herb furlough
adoption Cahill accusation halogen plastisol drier Carib prank
Skopje devote uppermost negligent gibbet Rochester Linotype

The obvious things that emerge from reading even a few of these emails are:

* The “From:” email address field contents seem to be copied from a list (probably harvested from Usenet posts)
* The “From:” name (in brackets) is composed of a first name from a different list, followed by up to two words from the main list of body words
* The “Subject:” is composed of a word from a different list again, followed by up two two words from the main list of body words
* The words in the body seem to have been randomly pulled from a list of low-frequency words (again, probably harvested from Usenet posts)
* The “organization” header is filled in with a single word that appears to be randomized from a yet different list

So… Where Does “Markovian Parallax Denigrate” Fit In?

These three ‘signature’ words appeared more often than others in the body of postings to different Usenet groups (in the case of “Markovian”, roughly 8x as frequently as other body words, less so for the other two): but oddly, in alt.religion.christian.boston-church “Markovian” only appears twice in email headers, and never in any of the bodies.

So even though “Markovian Parallax Denigrate” has become the name by which these spam messages are generally known, the actual usage of them is much more nuanced than is generally thought or believed.

For instance, this was not at all true of the messages to the alt.religion.christian.boston-church group. There, most frequent spam words were “cindy” and “thimbu” (8 occurrences each), followed by “cress”, “pump”, “Denny”, “laissez”, “pussycat”, “photolysis”, “inflammation”, “millenarian”, “synergism”, “vet”, “Joss”, “Smithfield”, and “springboard” (7 occurrences each). “Markovian” only appears in two headers spammed to the alt.religion.christian.boston-church group. These are completely consistent with a purely random distribution, with no Markovian-style tweaking.

Yet at the same time, the rest of the body word list seems identical: for example, both contain “pornography” and “pornographer” but not “pornographic”. OK, there are too few words in the alt.religion.christian.boston-church spam messages to be completely sure (they only seem to use about a quarter of the overall body word dictionary), but this seems almost certain.

My suspicion is therefore that “Markovian” (plus “Parallax” and “Denigrate” to a lesser degree) may initially have been intended as trap words (i.e. for the spammer’s own killfile), e.g. so that he/she could easily filter out most/all spam traffic to news.admin.net-abuse.misc by deleting all messages with any of those words. I think this would have been important for the spammer, so that they could see the havoc they were wreaking as it happened, by reading the narked messages squeezed inbetween all the spam. The whole thing was, after all, surely a performance done more for the reaction than for the action itself, so where would the fun be in pissing admins off if you couldn’t see them being pissed off?

Who Was Behind This Attack?

At the time, Catherine Hampton posted:

There is some possibility that this is also a loon who hates Christians and/or Christianity, but IMHO it’s more likely that that side of things is a red herring to mislead people looking for the perpetrator.

It’s a little insulting to admit we’re probably irrelevant side-issues to this creep, but I think that’s the case. <sigh>

Since then, all manner of (to be honest, almost entirely speculative/rubbish) theories have emerged: one of the most famous of these was that the perpetrator was psychic-and-apparently-delusional “CIA asset” Susan Lindauer, because one of the email addresses used was susan_lindauer@…. However, in 2012 this theory was ably debunked by Kevin Morris, who showed that it had been a completely different Susan Lindauer (whose name had merely been randomly harvested, along with thousands of others), so we can leave both Lindauers and that theory well behind now. Which is nice.

Yet I think what we already know we can tell quite a lot about the spammer. The fact that he/she mailbombed Catherine Hampton would seem to me to be a sign that this was not one of America’s few angry atheists, virtually firebombing plucky Christians’ online temples: rather, I think this was instead a sign that the spammer was himself/herself a Christian (perhaps even one specifically living in Boston) who had been flamed or abused online, and had decided to pay back that grudge in a fairly public way. (Yet because the alt.religion.christian.boston-church group seemed to have purely random traffic (i.e. no “Markovian” trap word), it is possible that this was – as Catherine Hampton suspected – just a distraction from the news.admin.net-abuse.misc main event: so doubt remains.)

But even so: given that connection as a starting point, I strongly suspect that the choice of which groups to attack was also far from random. Rather, it would seem likely that the spammer was a subscriber to several (if not all) of those groups, and who held some kind of broader grudge. I’m sorry to have to point out the obvious, but from the 1996 group traffic I’ve gone through, online Christians had no obvious shortage of flamers (and indeed trolls) in their ranks: spam was already a significant Usenet-wide problem by then, and administrators were constantly having to cancel spam messages that sneaked past their extensive filters and killfiles.

So even though these were all unmoderated groups, the spammer still needed a pretty good knowledge of group post headers and spoofing tricks to get spam in: so we can say that this was someone who was very comfortable with the minutiae (and limitations) of current networking lore cirac 1996. (It would therefore seem reasonable to wonder whether he or she might well have been a group administrator at that time.)

Finally, from the number of different text lists that the spammer compiled to randomly fill the different fields, I think it is clear that he/she was someone who was not only computer literate, but also quite driven by the idea of producing unstoppable spam. I’m sure that this was an angry idea that (I think) had stewed and steeped over a period of time – that is, not something that impulsively happened in a single mad day (because nobody would produce so many different lists for merely a whim, however angry), but something premeditated that had built up over weeks or even months.

Bob Allisat?

The only non-Susan-Lindauer name I found suggested (trampolined by way of Emily D’s Ephemeral Curios) was by Phil Launchbury, who wrote (replying to Catherine Hampton on the same day):

The only common denominator is that the posting host has been set to Jan Isleys machine in Atlanta – probably as revenge for his legitimate cancelling activities.

The name of the perp that springs to mind is Bob Allisat… It may not be, but it has the same level of content and interest as the blank verse he spams across Usenet 🙂 He also has a long running (and on Bobs side) bitter feud with Jan & Atlanta in general.

To be honest, I’m quite certain that Bob Allisat’s not-really-very-good poetry – though he did resolutely spam it to multiple Usenet groups – has nothing at all in common with the whole Markovian ‘enterprise’. Though it is true that in 1995 he arranged an online “Poetry Slam [that] saw 15,000 plus wild poems, every poem differant, swamp the news.admin.net-abuse.misc newsgroup over the course of a few hours. The net.cops totally phreaked.” So I suspect Phil Launchbury may have named Bob Allisat just to annoy him back, rather than out of genuine suspicion. Just so you know. 🙂

 In future poetry is all
  that I'll be sharing with
   you good folks out there.
    I will be a plague of poetry,
     an endless stream of poetry,
      I will innundate you all with
       poetry, I will flood every
        discussion with poems, poems
         and more poems. The world of
          power guys and technotics
           needs poetry to heal it's
            twisted barbaric soulnessless

Could We Track Down The Markovian Spammer?

I think there is a reasonably good chance that the Markovian spammer subscribed to most (if not all) of the groups that were attacked during the year prior to 5th August 1996. Hence it might well be that if someone were to cross-check all the people who sent (genuine) posts to more than one of those lists during the previous year, we might have something resembling a short list of suspects (I’d expect no more than 4 or 5 people to remain). Looking for flamey reactions to their posts might also help order the list in terms of likelihood of being the spammer.

Perhaps someone has already tried this kind of forensic approach (Heaven knows the group admins were pissed off enough at the time): however, what remains of Internet commentary on “Markovian Parallax Denigrate” seems fairly lightweight, and I haven’t seen any clear attempt at doing so out there. Unless you know better?